Skip to content

fix(stack): bulk-model id split corrupts field names containing hyphens#548

Merged
freshtonic merged 1 commit into
mainfrom
fix/bulk-model-id-hyphen-split
Jul 4, 2026
Merged

fix(stack): bulk-model id split corrupts field names containing hyphens#548
freshtonic merged 1 commit into
mainfrom
fix/bulk-model-id-hyphen-split

Conversation

@freshtonic

@freshtonic freshtonic commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

Summary

The bulk model helpers key per-field operation results by ${modelIndex}-${fieldKey} ids, and reconstruction split that id with a naive key.split('-') — truncating any field key containing a hyphen (some-fieldsome): the encrypted/decrypted value landed under the truncated key and the real field silently vanished from the model. The bug was duplicated byte-identically across all four multi-model reconstruction sites (bulk encrypt/decrypt, with and without lock context) since f1248d5f.

Fix

One fieldsForModelIndex helper that splits at the first hyphen only, used at all four sites (also removes the 4× duplication).

Tests

Offline regression suite (mocked protect-ffi): hyphenated (some-field) and multi-hyphen (multi-part-name) column names survive bulkEncryptModels / bulkDecryptModels, with explicit assertions that no truncated keys appear. Verified both tests fail against the naive split before the fix.

Provenance

Flagged in the consolidated review on #547 (🔴 "bulk-encrypt id ${idx}-${key} corrupts field names containing -") — pre-existing on main, so fixed here rather than in that stacked PR.

Summary by CodeRabbit

  • Bug Fixes
    • Fixed bulk encrypt/decrypt handling so field names with hyphens are preserved correctly across multiple models.
    • Improved reconstruction of nested fields to avoid shortening keys like some-field or multi-part-name.
  • Tests
    • Added regression coverage for bulk model encryption and decryption with hyphenated field names.

The bulk model helpers key per-field operation results by
`${modelIndex}-${fieldKey}` ids and reconstructed models with a naive
key.split('-'), truncating any field key containing a hyphen
(some-field → some): the value landed under the truncated key and the
real field silently vanished. Duplicated across all four multi-model
reconstruction sites since f1248d5.

Extract one fieldsForModelIndex helper that splits at the FIRST hyphen
only and use it at all four sites. Offline regression tests (mocked
protect-ffi) prove hyphenated and multi-hyphen field names survive
bulkEncryptModels / bulkDecryptModels — both fail against the naive
split.

Flagged in the consolidated review on #547 (pre-existing, out of that
PR's scope).
@freshtonic freshtonic requested a review from a team as a code owner July 4, 2026 02:56
@changeset-bot

changeset-bot Bot commented Jul 4, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 632bdf6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Jul 4, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Adds a fieldsForModelIndex helper in model-helpers.ts that splits bulk operation result ids at the first hyphen instead of all hyphens, preserving hyphenated field keys. This helper replaces prior reconstruction logic in four bulk encrypt/decrypt functions. A regression test file validates this behavior.

Changes

Hyphenated field key fix

Layer / File(s) Summary
fieldsForModelIndex helper and integration
packages/stack/src/encryption/helpers/model-helpers.ts
Adds fieldsForModelIndex, which extracts per-model fields from bulk result ids by splitting at the first hyphen only, and replaces prior Object.fromEntries/split('-') reconstruction in bulkEncryptModels, bulkDecryptModels, bulkDecryptModelsWithLockContext, and bulkEncryptModelsWithLockContext.
Regression test for hyphenated fields
packages/stack/__tests__/bulk-model-hyphen-fields.test.ts
New Vitest test mocking @cipherstash/protect-ffi bulk encrypt/decrypt, defining a users schema with hyphenated column names, and asserting full hyphenated keys are preserved without truncation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant bulkEncryptModels
  participant fieldsForModelIndex
  participant ProtectFFI

  Client->>bulkEncryptModels: bulk encrypt request with hyphenated fields
  bulkEncryptModels->>ProtectFFI: encryptBulk(payload)
  ProtectFFI-->>bulkEncryptModels: encryptedData keyed by modelIndex-fieldKey
  bulkEncryptModels->>fieldsForModelIndex: fieldsForModelIndex(encryptedData, modelIndex)
  fieldsForModelIndex-->>bulkEncryptModels: fieldKey map (first-hyphen split preserved)
  bulkEncryptModels-->>Client: reconstructed model with hyphenated keys intact
Loading

Suggested reviewers: auxesis

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main bug fix: bulk model id splitting no longer corrupts hyphenated field names.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/bulk-model-id-hyphen-split

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/stack/__tests__/bulk-model-hyphen-fields.test.ts (1)

78-118: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Missing coverage for lock-context variants.

Only bulkEncryptModels/bulkDecryptModels are tested. The same fieldsForModelIndex fix also applies to bulkEncryptModelsWithLockContext/bulkDecryptModelsWithLockContext (model-helpers.ts lines 809, 872), which remain untested by this regression suite.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/stack/__tests__/bulk-model-hyphen-fields.test.ts` around lines 78 -
118, Add regression coverage for the lock-context bulk helpers because the
hyphenated-field fix in fieldsForModelIndex also affects
bulkEncryptModelsWithLockContext and bulkDecryptModelsWithLockContext. Extend
the bulk-model-hyphen-fields test suite with cases that call those two methods,
using the same hyphenated keys assertions as the existing bulkEncryptModels and
bulkDecryptModels tests. Keep the checks focused on the named helpers so the
suite verifies hyphenated field names remain intact in both lock-context and
non-lock-context paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/stack/__tests__/bulk-model-hyphen-fields.test.ts`:
- Around line 78-118: Add regression coverage for the lock-context bulk helpers
because the hyphenated-field fix in fieldsForModelIndex also affects
bulkEncryptModelsWithLockContext and bulkDecryptModelsWithLockContext. Extend
the bulk-model-hyphen-fields test suite with cases that call those two methods,
using the same hyphenated keys assertions as the existing bulkEncryptModels and
bulkDecryptModels tests. Keep the checks focused on the named helpers so the
suite verifies hyphenated field names remain intact in both lock-context and
non-lock-context paths.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ddbb1afc-1167-4fe1-b91a-3cbee7f6661b

📥 Commits

Reviewing files that changed from the base of the PR and between b650a8c and 632bdf6.

📒 Files selected for processing (2)
  • packages/stack/__tests__/bulk-model-hyphen-fields.test.ts
  • packages/stack/src/encryption/helpers/model-helpers.ts

@freshtonic freshtonic self-assigned this Jul 4, 2026
@freshtonic freshtonic requested review from coderdan and tobyhede July 4, 2026 03:41
@freshtonic freshtonic merged commit 97cd224 into main Jul 4, 2026
9 checks passed
@freshtonic freshtonic deleted the fix/bulk-model-id-hyphen-split branch July 4, 2026 03:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant